Database crash with invalid geoJSON input

[Johan Van de Wauw]

As reported upstream:
http://trac.osgeo.org/postgis/ticket/3094

Malformed geoJSON data can kill the database process. This functionality exists in trusty, utopic and vivid.

A fix has been prepared in debian unstable - an unblock request for jessie was requested:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781579

[Steve Beattie (sbeattie)]

Since the debian bug and the upstream bug report are public, there's no point in keeping this bug report private, so I've made it public as well. Has a CVE been assigned for this issue?

[Johan Van de Wauw (johanvdw)]

I don't think there is a CVE number. I asked in the upstream bugtracker to be sure.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "vivid debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs. I've uploaded them for building with a slight modification to the changelog to make it more consistent with our other security updates.

Security updates will be released once they've built.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgis - 2.1.5+dfsg-1~exp2ubuntu1

---------------
postgis (2.1.5+dfsg-1~exp2ubuntu1) vivid; urgency=high

  * SECURITY UPDATE: crash of the database backend process when given
    invalid GeoJSON data (LP: #1438875)
    - debian/patches/geojson-fix-3094.patch: back-ported from the 2.1.7
      release, taken from debian patch by Markus Wanner.
    - No CVE number
 -- Johan Van de Wauw <email address hidden> Wed, 01 Apr 2015 19:53:13 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgis - 2.1.3+dfsg-4ubuntu0.1

---------------
postgis (2.1.3+dfsg-4ubuntu0.1) utopic-security; urgency=high

  * SECURITY UPDATE: crash of the database backend process when given
    invalid GeoJSON data (LP: #1438875)
    - debian/patches/geojson-fix-3094.patch: back-ported from the 2.1.7
      release, taken from debian patch by Markus Wanner.
    - No CVE number
 -- Johan Van de Wauw <email address hidden> Wed, 01 Apr 2015 19:53:13 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgis - 2.1.2+dfsg-2ubuntu0.1

---------------
postgis (2.1.2+dfsg-2ubuntu0.1) trusty-security; urgency=high

  * SECURITY UPDATE: crash of the database backend process when given
    invalid GeoJSON data (LP: #1438875)
    - debian/patches/geojson-fix-3094.patch: back-ported from the 2.1.7
      release, taken from debian patch by Markus Wanner.
    - No CVE number
 -- Johan Van de Wauw <email address hidden> Wed, 01 Apr 2015 21:29:10 +0200